Title: [88779] branches/chromium/782/Source/WebCore
- Revision
- 88779
- Author
- cev...@google.com
- Date
- 2011-06-13 23:11:51 -0700 (Mon, 13 Jun 2011)
Log Message
Merge 88139
BUG=84002
Review URL: http://codereview.chromium.org/7145023
Modified Paths
Diff
Modified: branches/chromium/782/Source/WebCore/platform/graphics/TextRun.h (88778 => 88779)
--- branches/chromium/782/Source/WebCore/platform/graphics/TextRun.h 2011-06-14 05:55:56 UTC (rev 88778)
+++ branches/chromium/782/Source/WebCore/platform/graphics/TextRun.h 2011-06-14 06:11:51 UTC (rev 88779)
@@ -78,8 +78,8 @@
{
}
- UChar operator[](int i) const { return m_characters[i]; }
- const UChar* data(int i) const { return &m_characters[i]; }
+ UChar operator[](int i) const { ASSERT(i >= 0 && i < m_len); return m_characters[i]; }
+ const UChar* data(int i) const { ASSERT(i >= 0 && i < m_len); return &m_characters[i]; }
const UChar* characters() const { return m_characters; }
int length() const { return m_len; }
Modified: branches/chromium/782/Source/WebCore/platform/graphics/WidthIterator.cpp (88778 => 88779)
--- branches/chromium/782/Source/WebCore/platform/graphics/WidthIterator.cpp 2011-06-14 05:55:56 UTC (rev 88778)
+++ branches/chromium/782/Source/WebCore/platform/graphics/WidthIterator.cpp 2011-06-14 06:11:51 UTC (rev 88779)
@@ -80,6 +80,9 @@
offset = m_end;
int currentCharacter = m_currentCharacter;
+ if (currentCharacter >= offset)
+ return;
+
const UChar* cp = m_run.data(currentCharacter);
bool rtl = m_run.rtl();
Modified: branches/chromium/782/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp (88778 => 88779)
--- branches/chromium/782/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp 2011-06-14 05:55:56 UTC (rev 88778)
+++ branches/chromium/782/Source/WebCore/platform/graphics/chromium/ComplexTextControllerLinux.cpp 2011-06-14 06:11:51 UTC (rev 88779)
@@ -367,7 +367,7 @@
icu::UnicodeString normalizedString;
UErrorCode error = U_ZERO_ERROR;
- for (int16_t i = 0; i < originalRun.length(); ++i) {
+ for (int i = 0; i < originalRun.length(); ++i) {
UChar ch = originalRun[i];
if (::ublock_getCode(ch) == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(),
Modified: branches/chromium/782/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp (88778 => 88779)
--- branches/chromium/782/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp 2011-06-14 05:55:56 UTC (rev 88778)
+++ branches/chromium/782/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp 2011-06-14 06:11:51 UTC (rev 88779)
@@ -114,7 +114,8 @@
void walk(const TextRun& run, bool isVerticalText, const String& language, int from, int to)
{
- ASSERT(0 <= from && from <= to && to - from <= run.length());
+ if (from < 0 || to < 0 || from > to || from >= run.length() || to > run.length())
+ return;
const String text = Font::normalizeSpaces(run.data(from), to - from);
Vector<SVGGlyph::ArabicForm> chars(charactersWithArabicForm(text, run.rtl()));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
